PCNSE Practice Test 27 — 15 Questions

Question 1

Match each high availability (HA) term to its definition.

Question 2

Match each Palo Alto Networks product to its primary use case.

Question 3

Match each Palo Alto Networks feature to its primary function.

Question 4

Match each type of route to its description.

Question 5

A company is deploying SSL Forward Proxy decryption for outbound HTTPS traffic. They want to ensure that traffic to financial sites (e.g., *.bank.com) is not decrypted due to compliance requirements. Which method should be used to exclude this traffic from decryption?

Accepted Answer

Create a Decryption Policy rule matching the traffic and set the action to 'No Decrypt'.. Option C is correct because in Palo Alto Networks firewalls, SSL Forward Proxy decryption is controlled by Decryption Policy rules. To exclude specific traffic from decryption, you create a Decryption Policy rule that matches the traffic (e.g., destination domain *.bank.com) and set the action to 'No Decrypt'. This ensures the firewall forwards the traffic without intercepting or decrypting it, meeting compliance requirements.

Answer

Configure the SSL/TLS Service Profile to bypass decryption for the domain.

Answer

Configure a Decryption Profile to exclude the domain.

Answer

Enable certificate revocation checking for the decryption zone.

Question 6

Which TWO troubleshooting steps should be performed when a user cannot access an internal server through a Palo Alto Networks firewall, and the traffic log shows that the session was dropped by a security rule?

Accepted Answer

Check the rule order to see if a rule earlier in the policy is also matching. When a session is dropped by a security rule, the traffic log will show the specific rule that denied the traffic. The most direct troubleshooting step is to review that rule's configuration (Option D) to ensure the source, destination, application, and service match the intended policy. Additionally, because Palo Alto Networks firewalls evaluate rules in top-down order, a later rule that would allow the traffic may be preempted by an earlier deny rule (Option B); checking rule order is critical to identify such a conflict.

Answer

Use the packet capture tool to capture the traffic

Answer

Enable logging at session end for all rules

Answer

Check the server's network connectivity

Question 7

A security engineer is troubleshooting a Palo Alto Networks firewall where HTTP traffic is being incorrectly identified by App-ID. The engineer has verified that the application is correctly configured in the application override policy. Which two factors could cause App-ID to fail to recognize the application?

Accepted Answer

SSL decryption is not enabled for the traffic.. Option C is correct because App-ID relies on analyzing the content of the traffic, including decrypted payloads, to identify applications. If SSL decryption is not enabled for HTTPS traffic, the firewall sees only encrypted packets and cannot inspect the application layer data, forcing App-ID to fall back to port-based or IP-based identification, which may misidentify the application.

Answer

The traffic is allowed by a security policy rule.

Answer

An application override policy is configured for the traffic.

Answer

The firewall is using port-based application identification.

Question 8

A security engineer is troubleshooting a traffic drop issue on a Palo Alto Networks firewall. The traffic is allowed by the security policy, but the session is being terminated. Which two features could cause this behavior? (Choose two.)

Accepted Answer

DoS Protection. A DoS Protection profile can terminate sessions that exceed configured thresholds for rate, connection count, or other attack-related criteria, even if the security policy explicitly allows the traffic. When the firewall detects that a session matches a DoS Protection rule and the traffic rate or concurrent session count surpasses the defined threshold, it will drop the session to mitigate the attack, overriding the allow action from the security policy.

Answer

User-ID

Answer

SSL Decryption

Answer

URL Filtering

Question 9

A systems administrator needs to configure log forwarding to an external syslog server for Security policies. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Create a syslog server profile under Device > Server Profiles > Syslog.. To forward logs to an external syslog server, you must first create a syslog server profile under Device > Server Profiles > Syslog (option A). Then, you need to create a Log Forwarding profile that references that server profile and apply it to the Security policy rules (option C). Options B, D, and E are incorrect because SNMP traps are for different purposes, you cannot apply a server profile directly to a rule, and there is no global log forwarding setting.

Answer

Create an SNMP trap profile under Device > Server Profiles > SNMP Trap.

Answer

Directly apply the syslog server profile to each Security policy rule.

Answer

Enable log forwarding under the firewall's Device > Setup > Logging and Reporting settings.

Question 10

Refer to the exhibit. A network engineer notices that logs for this rule are not being forwarded to the external syslog server. The syslog server profile is configured correctly. What is the most likely cause?

Accepted Answer

The log-setting profile "syslog-forwarding-profile" is missing from the Log Forwarding profiles configuration.. The rule references a log-setting profile named "syslog-forwarding-profile". If this profile is not defined under Objects > Log Forwarding, logs will not be forwarded regardless of the server profile configuration. Option A is correct. Option B is incorrect because log-end is set to yes, which forwards session end logs. Option C is incorrect because destination zones are not required for logging. Option D is incorrect because web-browsing application does generate logs.

Answer

The rule does not specify a destination zone.

Answer

The log-start is set to no, preventing session start logs from being generated.

Answer

The application web-browsing does not generate logs.

Question 11

Refer to the exhibit. What does the 'Session End Reason: aged-out' indicate about the traffic?

Accepted Answer

The session was idle for longer than the timeout threshold.. The 'Session End Reason: aged-out' indicates that the firewall terminated the session because it remained idle for longer than the configured timeout threshold. Palo Alto Networks firewalls use application-specific timeouts (e.g., TCP default 3600 seconds, UDP 30 seconds) to free resources from sessions that have stopped transmitting data. This is a normal cleanup mechanism, not a policy or explicit termination.

Answer

The session was terminated by a firewall policy.

Answer

The session was forcibly closed by an administrator.

Answer

The session ended due to a TCP FIN/RST from the client.

Question 12

A company has deployed SSL Inbound Inspection to inspect HTTPS traffic to their internal web server hosting a custom application that requires mutual TLS authentication. The firewall is configured with a decryption policy that includes the server's certificate and the action 'decrypt'. The web server is configured to request client certificates. After implementation, users report that the application fails to authenticate them. The firewall logs show that SSL handshake with the client completes successfully, but the server never receives the client certificate during the handshake. The administrator has verified that the decryption policy is active and the server certificate is correctly imported. What is the most likely cause of this issue?

Accepted Answer

The firewall is not configured to forward client certificates to the server.. In SSL Inbound Inspection, the firewall acts as a man-in-the-middle, terminating the client's SSL connection and then initiating a new SSL connection to the server. By default, the firewall does not forward the client certificate from the original client handshake to the server. To enable mutual TLS authentication, the administrator must explicitly configure the firewall to forward client certificates, typically via a Decryption Profile setting. Since the logs show a successful handshake with the client but the server never receives the client certificate, the missing forwarding configuration is the most likely cause.

Answer

The decryption policy is set to 'no-decrypt' for the application's traffic.

Answer

The client certificates are not trusted by the firewall.

Answer

The firewall's SSL Inbound Inspection profile is set to 'passive' mode.

Question 13

An administrator notices that URL filtering is not blocking a specific category as configured. What is the first troubleshooting step?

Accepted Answer

Verify the security policy order. The most common reason URL filtering fails to block a specific category is that a security policy with a lower priority (higher order number) is matching the traffic before the policy with the correct URL filtering profile. Since security policies are evaluated top-down, the first match is applied, and if an earlier policy allows the traffic without URL filtering, the configured block action is never reached. Therefore, verifying the security policy order is the first and most logical troubleshooting step.

Answer

Review the URL filtering profile

Answer

Check the URL filtering license

Answer

Check the PAN-DB version

Question 14

Refer to the exhibit. An administrator has configured this decryption policy but users in the 10.1.1.0/24 subnet receive certificate warnings when accessing HTTPS sites. What is the most likely cause?

Accepted Answer

The decryption certificate is not trusted by clients. Option D is correct because certificate warnings occur when the decryption certificate used by the firewall is not trusted by the client machines. In a forward proxy decryption scenario, the firewall generates a new certificate on-the-fly for each HTTPS session, and if that certificate is not installed in the client's trusted root store, the browser will display a security warning. This is the most common cause of certificate warnings in decryption deployments.

Answer

The rule should be at the top of the rulebase

Answer

The destination address should be specific

Answer

The application should be web-browsing

Question 15

A security administrator is troubleshooting a traffic drop between two internal zones. The firewall shows that the session is being terminated with a 'tcp-fin' reason. The administrator verifies that the application is set to 'web-browsing' and the service is 'application-default'. What is the most likely cause of the session termination?

Accepted Answer

The application override is incorrectly configured for the traffic.. When an application override is incorrectly configured, the firewall terminates the session with a 'tcp-fin' reason because it cannot match the expected application signature. The 'web-browsing' application expects HTTP traffic, but the actual payload may be non-HTTP (e.g., SSH or custom protocol), causing the firewall to send a TCP FIN to close the session gracefully. This is distinct from a reset (RST) or drop, as the firewall completes the TCP handshake but then terminates due to application mismatch.

Answer

The security policy has a deny action for the traffic.

Answer

The traffic is being asymmetrically routed.

Answer

The zone protection profile is dropping the session.